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CCPA - Frequently Asked Questions 


ICE is committed to protecting and safeguarding the Personal Information of our members, customers 
and users (“Customer(s)”). The following FAQs provide an explanation of the California Consumer 
Privacy Act (“CCPA”) and how ICE is working to protect Personal Information. 


What is CCPA? 


The California Consumer Privacy Act, or CCPA, is a privacy protection law voted in by California 
lawmakers in 2018. Its purpose is to protect the Personal Information of California residents 
(“consumers”). 


What is Personal Information? 


Under CCPA, “Personal Information” refers to information that identifies, relates to, describes, and is 
linked to or associated with a consumer or household. Personal Information can be anything from a 
name, a photo, an email address, bank details, posts on social networking websites and medical 
information to online identifiers such as location data or a computer IP address. 


My company is not in California. Does CCPA apply? 


CCPA places obligations on “businesses” headquartered inside or outside of California, which collect 
Personal Information of California state residents and satisfy at least one of three conditions: 
e Annual gross revenue of more than $25 million. 
e Handling (buying, selling, etc.) personal information of more than 50,000 California-based 
consumers, households, or devices annually. 
e Gets at least 50 percent of annual revenue from selling California consumers’ personal 
information. 


How does ICE protect Personal Information? 


ICE has implemented vigorous technical and organizational measures to protect the Personal 
Information of our Customers against accidental or unlawful destruction, loss, alteration, unauthorized 
disclosure of, or access to, Personal Information. For more information on ICE security please visit: 
https://www.theice.com/security. 


For what purposes does ICE collect Personal Information? 


Where a Customer provides Personal Information to ICE for purposes of providing Services (“Customer’s 
Personal Information”), ICE acts as a Service Provider (as defined in the CCPA) with respect to such 
Customer’s Personal Information. ICE will process Customer’s Personal Information consistent with 
Intercontinental Exchange’s Privacy Policy and unless Customer provides prior written approval, ICE will 
not collect, retain, use, disclose, or sell Customer’s Personal Information for any purpose other than 
performing the Services, enabling ICE to meet its legal and regulatory requirements, marketing ICE’s 
products and services, or product improvement and development. 


How is ICE complying with CCPA? 
ICE has taken and continues to take appropriate measures to: 
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e Disclose collection. A business must disclose the categories and purposes of collecting Personal 
Information. When receiving a verifiable consumer request, they must also disclose the specific 
pieces of Personal Information they have collected. 

e Have a CCPA-compliant privacy policy. 

e Comply with ICE Customer requests as a Service Provider to our Customers. 

e Respect consumers’ rights under CCPA. This includes the right to access, the right to deletion, 
the right to data portability, and the right to opt-out of any sales of "Personal Information". 

e identify Personal Information “sales” across ICE businesses to enable ICE Customers to exercise 
their rights under CCPA to “opt-out” of any such sales. 


Does ICE use sub-processors? 


Yes, a list of sub-processors is available on the Data Protection webpage 
at https://www.theice.com/data-protection. 


Who Can | Contact with Questions? 


All questions and inquiries regarding CCPA and data protection should be sent to privacy@theice.com. 


